Ruby on Rails 4 API - update devise user -

i'm trying build api rails 4. everything(show/delete/create) works fine, update gives me error:

activemodel::forbiddenattributeserror in api::v1::userscontroller#update

my update method this:

def update   @user = user.find_by_id(params[:id])   if @user.nil?     logger.info("user not found.")   render :status => 404, :json => {:status => "error", :errorcode => "11009", :message => "invalid userid."}   else     @user.update(params)     render :status => 200, :json => {:status => "success", :user => @user, :message => "the user has been updated"}   end end 

i send post request http://localhost:3000/api/v1/users/3 , i'm sending username:testuser via patch - should right rails 4.

i guess i'm forgetting allow paramets updated?

i forgot syntax in rails 4. needed replace @user.update(params) @user.update_attributes(params.permit(:email, :username, :password))